CN108140335B

CN108140335B - Secret random number synthesis device, secret random number synthesis method, and recording medium

Info

Publication number: CN108140335B
Application number: CN201680059243.XA
Authority: CN
Inventors: 滨田浩气; 菊池亮
Original assignee: Nippon Telegraph and Telephone Corp
Current assignee: Nippon Telegraph and Telephone Corp
Priority date: 2015-10-13
Filing date: 2016-10-11
Publication date: 2020-12-29
Anticipated expiration: 2036-10-11
Also published as: EP3364398A1; EP3364398B1; WO2017065123A1; CN108140335A; US20180261133A1; US10657847B2; JPWO2017065123A1; EP3364398A4; JP6583970B2

Abstract

The present invention efficiently creates a hidden corpus of values a, b, c having a relationship of c ═ ab. A hidden character generation unit (12) generates a hidden character satisfying x for i 0_i＝f(k_i) X of_iHidden text of (1)_i]And satisfy y_i＝g(k_i) Y of (A) to (B)_iHidden text of (y)_i]. A fragment generation unit (13) generates a restored [ x ] for i ═ 1_i]‑[a_i]Is/are as follows_iAnd recover [ y_i]‑[b_i]Rho of_iCalculate [ c_i]+_i[b_i]+ρ_i[a_i]+_iρ_iGenerating a hidden text [ z ]₁]，...，[z_m]. The random number synthesis unit (14) uses different values k₀，...，k_mAnd secret text [ z₁]，...，[z_m]Generating a hidden text [ z ]₀]。

Description

Secret random number synthesis device, secret random number synthesis method, and recording medium

Technical Field

The present invention relates to an encryption application technology, and more particularly to a technology for performing random number synthesis without exposing input data.

Background

As a method of obtaining a specified operation result without restoring an encrypted numerical value, there is a method called secret calculation (see, for example, non-patent document 1). In the method of non-patent document 1, encryption is performed in which so-called pieces of numerical values are distributed among three secret computing devices, and the three secret computing devices perform coordinated computation, so that the results of addition and subtraction, constant addition, multiplication, constant multiplication, logical operation ("no", "and", "or", "exclusive or"), and data format conversion (integer, binary) can be kept distributed among the three secret computing devices, that is, they can be kept encrypted, without restoring the original numerical values.

When multiplication is performed in secret calculation, there is a method of non-patent document 2 as a method that can efficiently perform multiplication using hidden texts having a relation of c ═ ab among plaintext a, b, and c.

Documents of the prior art

Non-patent document

Non-patent document 1: qiantaoshi, Tianhaoyao, fifty Dada, g Yi, "" light quantitative determination maybe 3 パーティ secret Seki count Zhi Ding "(CSS), 2010 year

Non-patent document 2: ivan Damgard, Marcel Keller, Enrique Larraia, Valero Pastro, Peter Scholl, and Nigel P.Smart, "Practical overview Security MPC for variance major-or Breaking the SPDZ limits", Computer Security-ESORICS 2013, vol.8134of feature Notes in Computer Science, pp.1-18, 2013.

Disclosure of Invention

Problems to be solved by the invention

However, in the conventional technique described in non-patent document 2, in order to create a concealed corpus in which plaintext a, b, and c have a relationship of c ═ ab, somewhat homomorphic encryption with a very high calculation cost is used, and efficiency is deteriorated.

In view of the above, an object of the present invention is to provide a technique for efficiently creating a hidden corpus having values a, b, and c in a relationship where c ═ ab.

Means for solving the problems

In order to solve the above problem, a secret random number combining device of the present invention includes: the hidden word generation unit generates a hidden word satisfying x when i is 0, …, m_i＝f(k_i) X of_iHidden text of (1)_i]And satisfy y_i＝g(k_i) Y of (A) to (B)_iHidden text of (y)_i](ii) a The fragment generation unit generates a restored [ x ] for i 1, …, m_i]-[a_i]Is/are as follows_iAnd recover [ y_i]-[b_i]Rho of_iCalculate [ c_i]+_i[b_i]+ρ_i[a_i]+_iρ_iGenerating a hidden text [ z ]₁]，…，[z_m](ii) a And a random number synthesis unit for calculating the following formula and generating a hidden text [ z₀]，

Wherein the content of the first and second substances,

wherein t is an integer of 0 or more, m is 2t +1, i is an integer of 1 to m, and [ a ] is_i]、[b_i]、[c_i]Are respectively set to m values a_i、b_i、c_iThe secret text of (1) is₀，…，k_mM +1 different values are set, and f (x) and g (x) are set to random t-degree polynomials.

ADVANTAGEOUS EFFECTS OF INVENTION

According to the secret random number synthesis technique of the present invention, it is possible to efficiently create a concealed corpus of values a, b, and c having a relationship of c ═ ab.

Drawings

Fig. 1 is a diagram illustrating a functional configuration of a secret random number synthesis system.

Fig. 2 is a diagram illustrating a functional configuration of a secret random number combining apparatus.

Fig. 3 is a diagram illustrating a process flow of a secret random number synthesis method.

Detailed Description

Before the embodiments are explained, the definitions of the labeling methods and terms in the present specification will be explained.

< labeling method >

A value in which a certain value a is concealed by encryption, secret distribution, or the like is referred to as a concealed text of a, and is denoted as [ a ]]. Also, a is referred to as [ a ]]The plaintext of (1). When the concealment is changed to secret distribution, the secret is passed through [ a ]]Refer to the collection of secret dispersed fragments that aspects (party) have. With [ a ]]_iReference to hidden text [ a ]]Aspect I of (1) P_iHaving the same. The shares are segments that are secretly distributed, and the aspects are coordinatedEach participant of the secret calculation.

< recovery >

The process of calculating the plaintext a from the hidden text [ a ] is referred to as restoration and is described by the following expression.

a←Reveal([a])

< addition, subtraction, constant times >

The hidden text [ a ] having two values a and b for each operation of addition and subtraction of the hidden text]、[b]As input, calculating the calculation results d of a + b and a-b₁、d₂Hidden text of (d)₁]、[d₂]. Secret text [ a ] with value a for operation of constant multiple of secret text]And a plaintext c as inputs, calculating a calculation result d of ca₃Hidden text of (d)₃]. The execution of these operations is described by the following expression.

[d₁]←Add([a],[b]),

[d₂]←Sub([a],[b]),

[d₃]←CMul(c,[a])

In addition, Add ([ a ], [ b ]), Sub ([ a ], [ b ]), CMul (c, [ a ]) will be abbreviated as [ a ] + [ b ], [ a ] - [ b ], c [ a ], respectively, without causing misunderstandings.

< Generation of random secret text >

The process of generating the secret text [ r ] of the random value r unknown to anyone is described as follows.

[r]←Rand()

Hereinafter, embodiments of the present invention will be described in detail. In the drawings, the same reference numerals are given to constituent elements having the same functions, and redundant description is omitted.

[ first embodiment ]

As illustrated in fig. 1, the secret random number combining system according to the first embodiment includes n (≧ 2) secret random number combining devices 1₁，…，1_n. In the present embodiment, the secret random number synthesizing apparatus 1₁，…，1_nAre each connected to a communication network 2. The communication network 2 is a device 1 capable of combining secret random numbers₁，…，1_nForm of communicationThe communication Network of the circuit switching system or the packet switching system of (1) may use, for example, the internet, a Local Area Network (LAN), a Wide Area Network (WAN), or the like. Moreover, the respective devices do not necessarily need to be able to communicate online via the communication network 2. For example, the input may be configured to be input to the secret random number synthesizing apparatus 1_iInformation (i ∈ {1, …, n-1}) is stored in a removable recording medium such as a magnetic tape or a USB memory, and is input online from the removable recording medium.

As illustrated in fig. 2, the secret random number synthesizing apparatus 1 includes: an input unit 11; a hidden text generation unit 12; a segment generating unit 13; a random number synthesizing unit 14; and an output unit 15. The secret random number combining apparatus 1 implements the secret random number combining method according to the first embodiment by performing the processing of each step illustrated in fig. 3.

The secret Random number combining device 1 is a special device configured by reading a special program into a known or special computer having, for example, a Central Processing Unit (CPU) and a main storage device (RAM). The secret random number combining device 1 executes each process under the control of, for example, a central processing unit. The data input to the secret random number combining device 1 or the data obtained in each process is stored in, for example, a main storage device, and the data stored in the main storage device is read out to a central processing unit as necessary and used for other processes. At least a part of each processing unit of the secret random number combining apparatus 1 may be constituted by hardware such as an integrated circuit.

Referring to fig. 3, a process of the secret random number synthesis method of the first embodiment will be described.

In step S11, m sets of values a are input to the input unit 11_i、b_i、c_iSecret text ([ a ]_i]，[b_i]，[c_i]) And m +1 values k₀，…，k_m. Here, m is 2t +1, t is an integer of 0 or more, and i is each an integer of 1 or more and m or less. Value k₀，…，k_mAre different arbitrary values and are totally secretCryptographic random number synthesizer 1₁，…，1_nSharing is performed in advance. Value k₀，…，k_mThe information is sent to the hidden text generation unit 12. Secret text ([ a ]_i]，[b_i]，[c_i]) Is sent to the clip generating unit 13.

In step S121, the hidden text generation unit 12 generates a random t-degree polynomial in which f (x) is unknown, and i is 0, …, and m, so as to satisfy x_i＝f(k_i) X of_iHidden text of (1)_i]. A random t-th order polynomial means that the coefficients of the terms are randomly determined t-th order polynomials. Secret text x₁]，…，[x_m]Is sent to the clip generating unit 13. Secret text x₀]Is transmitted to the output unit 15.

Specifically, the hidden text generation unit 12 generates the hidden text [ x ] as follows₀]，…，[x_m]. First, equation (1) is calculated for i equal to 0, …, t, and a hidden text [ x ] is generated₀]，…，[x_t]。

[x_i]←Rand()…(1)

Next, equation (2) is calculated for i +1, …, m, and a hidden text [ x ] is generated_t+1]，…，[x_m]。

Wherein, … (2)

In step S122, the hidden text generation unit 12 generates a random t-degree polynomial in which g (x) is unknown, and i is 0, …, and m so as to satisfy y_i＝g(k_i) Y of (A) to (B)_iHidden text of (y)_i]. Secret text y₀]，…，[y_m]The method of generating the same is only to generate the hidden text [ x ]₀]，…，[x_m]The same procedure may be carried out. Secret text y₁]，…，[y_m]Is sent to a segment generatorInto a unit 13. Secret text y₀]Is transmitted to the output unit 15.

In step S131, the segment generating section 13 calculates expression (3) for i equal to 1, …, m, and generates a value_i。

_i←Reveal([x_i]-[a_i])…(3)

In step S132, the segment generating section 13 calculates expression (4) for i equal to 1, …, m, and generates a value ρ_i。

ρ_i←Reveal([y_i]-[b_i])…(4)

In step S133, the segment generating section 13 generates a hidden text [ z ] by calculating equation (5) for i equal to 1, …, m_i]. Secret text [ z ]₁]，…，[z_m]Is transmitted to the random number synthesizing unit 14.

[z_i]←[c_i]+_i[b_i]+ρ_i[a_i]+_iρ_i…(5)

In step S14, the random number synthesis unit 14 calculates expression (6) and generates a hidden text [ z₀]. Secret text [ z ]₀]Is transmitted to the output unit 15.

Wherein, … (6)

In step S15, the output section 15 outputs the hidden text set ([ x ]₀]，[y₀]，[z₀])。

[ second embodiment ]

The secret random number synthesis method according to the second embodiment is a method of generating a hidden text set having values a, b, and c having a relationship of c ═ ab when secret distribution by addition is concealed. In the present embodiment, the hidden text [ a ] is input_i]，[b_i]，[c_i]And the generated hidden text [ x [ ]_i]，[y_i]，[z_i]Is a secret dispersed secret text based on addition. The secrecy dispersion of addition is described in, for example, non-patent document 2.

In step S121, the hidden text generation unit 12 of the second embodiment outputs the hidden text [ x ] to the input device where i is 0, …, t_i]Then, a random value is generated in every direction, and the generated value is set as a hidden text [ x ]_i]The fraction of (c). Then, in step S122, a hidden text [ y ] is generated for i ═ 0, …, t_i]Then, random values are generated in all directions, and the generated values are set as the secret text [ y ]_i]The fraction of (c).

With the above configuration, according to the secret random number synthesis technique of the present invention, even a desired person does not know and c is satisfied_i＝a_ib_iRandom m (═ 2t +1) group of values (a)_i，b_i，c_i) Secret text ([ a ]_i]，[b_i]，[c_i]) In the case where any value of t group is leaked, a hidden text ([ x, y, z)) of a group (x, y, z) satisfying a random value where z ═ xy) unknown to anyone may be created]，[y]，[z])。

The invention is characterized in that the random value x is used₀、y₀The multiplication of the hidden text (2) is performed by decomposing the hidden text (2) into 2t +1 multiplications. At this time, [ x ] is dispersed because of the secret using the (t +1, 2t +1) threshold value]And [ y]Since the information is distributed over 2t +1 hidden texts, x and y cannot be restored even if t-group information in the 2t + 1-group hidden text leaks. As a result, a confidential text of a random value group can be created, which is unknown to anyone.

The present invention is not limited to the above-described embodiments, and it goes without saying that modifications can be made as appropriate within the scope not departing from the gist of the present invention. The various processes described in the above embodiments may be executed not only in time series in the order described, but also in parallel or individually depending on the processing capability of the apparatus that executes the processes or the need.

[ program, recording Medium ]

When various processing functions in each device described in the above embodiments are realized by a computer, the contents of processing of the functions to be provided in each device are described by a program. Then, the computer executes the program, and the various processing functions in the above-described devices are realized on the computer.

The program in which the processing contents are described may be recorded in a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, an magneto-optical recording medium, and a semiconductor memory.

The distribution of the program is performed by, for example, selling, transferring, renting, or the like a portable recording medium such as a DVD or a CD-ROM on which the program is recorded. Further, the program may be stored in a storage device of a server computer, and the program may be distributed by transferring the program from the server computer to another computer via a network.

A computer that executes such a program first temporarily stores a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device, for example. Then, when executing the processing, the computer reads the program stored in its own recording medium and executes the processing according to the read program. In addition, as another execution mode of the program, the computer may directly read the program from the portable recording medium and execute the processing according to the program, or the computer may sequentially execute the processing according to the received program every time the program is transferred from the server computer to the computer. The above-described processing may be executed by a so-called ASP (Application Service Provider) Service that realizes a processing function only by an execution instruction and a result acquisition without transferring a program from a server computer to the computer. The program in this embodiment includes data (data which is not a direct instruction to the computer but has a property of specifying processing by the computer, etc.) which is information for processing by the electronic computer and is viewed in accordance with the program.

In this embodiment, the present apparatus is configured by executing a predetermined program on a computer, but at least a part of the contents of the processes may be realized by hardware.

Claims

1. A secret random number synthesizing apparatus comprising:

a hidden word generation unit for generating a hidden word satisfying x when i is 0, …, m_i＝f(k_i) X of_iHidden text of (1)_i]And satisfy y_i＝g(k_i) Y of (A) to (B)_iHidden text of (y)_i]；

The fragment generation unit generates a restored [ x ] for i 1, …, m_i]-[a_i]Is/are as follows_iAnd recover [ y_i]-[b_i]Rho of_iCalculate [ c_i]+_i[b_i]+ρ_i[a_i]+_iρ_iGenerating a hidden text [ z ]₁]，…，[z_m]；

A random number synthesis unit for calculating the following expression and generating a hidden text [ z₀]，

Wherein the content of the first and second substances,

and

an output unit for outputting the hidden text set ([ x ]₀]，[y₀]，[z₀])，

2. The secret random number synthesizing apparatus according to claim 1,

the hidden word generation unit generates a random value of a hidden word [ x ] for i 0, …, t_i]、[y_i]When i is t +1, …, m, the following expression is calculated to generate a hidden text [ x [ ]_i]、[y_i]，

Wherein the content of the first and second substances,

3. the secret random number synthesizing apparatus according to claim 2,

[a_i]、[b_i]、[c_i]、[x_i]、[y_i]、[z_i]is a secret dispersed secret ciphertext based on addition,

the hidden word generation unit generates a random value for i 0, …, t as a hidden word [ x_i]Generates a random value as a secret word [ y ]_i]The fraction of (c).

4. A secret random number synthesis method, comprising:

a hidden word generation step of generating a hidden word satisfying x when i is 0, …, m_i＝f(k_i) X of_iHidden text of (1)_i]And satisfy y_i＝g(k_i) Y of (A) to (B)_iHidden text of (y)_i]；

A fragment generation step in which the fragment generation means generates a restored [ x ] for i 1, …, m_i]-[a_i]Is/are as follows_iAnd recover [ y_i]-[b_i]Rho of_iCalculating[c_i]+_i[b_i]+ρ_i[a_i]+_iρ_iGenerating a hidden text [ z ]₁]，…，[z_m]；

A random number synthesis step in which a random number synthesis unit calculates the following formula to generate a secret text [ z ]₀]，

Wherein the content of the first and second substances,

and

an output step of outputting the hidden text set ([ x ]₀]，[y₀]，[z₀])，

5. A computer-readable recording medium storing a program for causing a computer to function as each means of the secret random number combining apparatus according to any one of claims 1 to 3.